Crypto-asset secondary service providers: licensing and custody requirements

By John Bassilios

Yesterday, Digital Economy Minister Jane Hume addressed the audience at Australian Blockchain Week coinciding with the release of the Government’s ‘Crypto asset secondary service providers: licensing and custody requirements’ consultation paper. Senator Hume introduced the consultation paper by stating that the crypto asset industry, with the right regulation, could be ‘as large as $68.4 billion’ by 2030.

The consultation paper outlines the Government’s approach to the introduction of a regulatory and licensing regime for crypto asset secondary service providers (CASSPrs) who offer crypto asset custody, storage, brokering, exchange and dealing services, or operate a market in crypto assets for retail consumers.

The consultation paper considers:

1. the current state of the crypto asset ecosystem;
2. proposals for a licensing regime for CASSPrs;
3. custody obligations to safeguard private keys; and
4. early views on the classification of crypto assets.

The expanding use cases of a virtual economy

From trustless digital currencies, the use of crypto assets has expanded into areas including gaming, art, real estate, lending and security. Through this period of expansion and innovation, Australians have been at the forefront of adoption, with Independent Reserve finding that 28% of Australians surveyed owned crypto assets in December 2021. The private and public sectors are also exploring the potential of crypto assets and blockchain technology, with recent examples of efforts from prominent organisations including:

• ASX replacing its Clearing House Electronic Subregister System (CHESS) with distributed ledger technology;
• Rio Tinto using blockchain to facilitate the trade of iron ore to a foreign country; and
• the Government’s Digital Economy Strategy, designed to position Australia to be ‘a top 10 digital economy and society by 2030 through $1.2 billion of strategic investment’.

The regulatory challenge

The consultation paper rejects the proposal that crypto assets should be regulated as financial products on the basis that, the principles for regulating crypto assets are not identical to those behind financial product regulation. Instead, the consultation paper considers that regulation of the two should be separate and distinct to provide for the differing characteristics and risks of each.

While traditional financial products rely on trust, crypto is trustless. However, the Government recognises that there is a difference between the trustless crypto asset and the services providers who facilitate access to those assets. The use of secondary service providers and centralised system actors introduces risk and requires trust, leading to a need to regulate those service providers.

Crypto assets are well known for being high risk following several high profile events where consumers have suffered significant losses (eg the failure of ACX.io and MyCryptoWallet). This has led to some in the industry calling for increased oversight, arguing that a licencing regime for CASSPrs would provide regulatory clarity for operators and protect consumers.

The consultation paper proposes to regulate CASSPrs who:

• provide retail consumers access to non-financial product crypto assets including brokers, dealers and market operators;
• provide safekeeping, custody, or storage of all crypto assets on behalf of a consumer; and
• are captured by the Financial Action Task Force’s definition of a Virtual Asset Service Provider for anti-money laundering and counter-terrorism financing reasons.

Proposed CASSPrs licensing regime

Consumers are currently exposed to significant financial and operational risks, including custody risks, when engaging with CASSPrs.

The proposal seeks to implement a CASSPr licencing regime, separate from the Australian Financial Service License regime, and administered by ASIC. In a move that will be welcomed by many, the Government has flagged its intention to avoid duplication, meaning that providers will likely only be required to hold a CASSPr license or an AFSL or Australian market licence (depending on the nature of the crypto asset and services provided).

The proposed obligations for CASSPr licensees include:

• do all things necessary to ensure that: the services covered by the licence are provided efficiently, honestly and fairly; and any market for crypto assets is operated in a fair, transparent and orderly manner;
• maintain adequate technological, and financial resources to provide services and manage risks, including by complying with the custody standards proposed in the consultation paper;
• maintain adequate internal and external dispute resolution arrangements;
• have adequate dispute resolution arrangements in place, including internal and external dispute resolution arrangements;
• maintain minimum capital requirements; and
• ensure directors and key persons responsible for operations are fit and proper persons and are clearly identified.

Proposed custody obligations to safeguard private keys

Consumers who access crypto assets through CASSPrs rely on their service provider to maintain custody of their crypto assets (ie safeguard their private keys) and are not well-placed to assess the security and resilience of CASSPr’s custody arrangements.

The consultation paper proposes to implement mandatory minimum custody obligations to CASSPrs who hold private keys on behalf of consumers.

Some of the proposed obligations include:

• holding crypto assets on trust for the consumer;
• ensuring that consumers’ assets are appropriately segregated;
• maintaining minimum financial requirements including capital requirements;
• ensuring that the custodian of private keys has the requisite expertise and infrastructure;
• processes for redress and compensation in the event that crypto assets held in custody are lost; and
• appropriate competencies for assessing compliance where custody is outsourced to a third party.

Early views sought on token mapping

The consultation paper is concerned with the complexity of crypto assets and the networks they operate on, and notes that the rights and functions associated with crypto assets can change over time.

Taking initial steps to address these concerns, the consultation paper also seeks feedback on types of crypto assets that will help inform the Government’s token mapping exercise. The Government aims to complete the token mapping exercise by the end of 2022. It is hoped that this exercise will provide further information on the current state of crypto assets in Australia and the risk and technology-based considerations that may influence how they are classified and regulated.

The consultation paper gives examples of crypto assets that include:

• utility crypto assets, which can only be redeemed for goods or services by the issuer. This includes loyalty schemes and digital vouchers represented with crypto assets;
• collectable crypto assets that include digital representations of real-world collectable items like art, image, music, in-game items, promotional posters;
• zero utility crypto assets that provide no promises, rights or use cases other than the ability to transfer them via a network; and
• asset-backed crypto assets used as a store of value, means of exchange and unit of account. These would include certain stablecoins and Central Bank Digital Currencies.

Additional areas of feedback sought

While the consultation paper provides a series of regulatory proposal, it also seeks feedback on the possibility of self-regulation and incorporating crypto assets into the existing framework for financial products, suggesting that these options have not yet been entirely ruled out.

The Government is also concerned with how CASSPrs will interact with the AML/CTF regime administered by AUSTRAC. The inclusion of ‘key persons’ in CASSPr licensing proposals hints there is likely to be some overlap between requirements for licensee and the existing registration requirements for Digital Currency Exchange providers. In response, the consultation paper is seeking responses on how CASSPrs should comply with AML/CTF obligations, and how to best avoid duplication.

Several of the Government’s questions to stakeholders involve the cost of implementing the consultation paper’s proposals signalling that while consumer protection is a priority, there is also a concern for promoting the industry in Australia and avoiding saddling providers with unsustainable costs for compliance.

However, the consultation paper also sets out minimum capital requirements proposed for licensees. While the paper does not propose specific figures, traditional custodians are required to hold between $150,000 and$10 million. If this is any indication of the Government’s plans for CASSPrs, smaller providers are unlikely to draw much comfort from the paper’s concern with implementation costs.

A new regulatory future for crypto?

The consultation paper recognises the growing importance of the crypto asset ecosystem to both the Australian and global economy, as well as the need for regulatory certainty to encourage innovation and competition, and to give consumers greater confidence in their dealings with CASSPrs.

Submissions and feedback to the consultation are open until 27 May 2022.

This article was written with the assistance of Eric Lay, Law Graduate.